Exploiting the Linux kernel via packet sockets

Summary: Project Zero's Andrey Konovalov found CVE-2017-7308, a signedness bug in the Linux kernel's packet_set_ring() function that lets a crafted PACKET_RX_RING option on an AF_PACKET socket with a TPACKET_V3 ring buffer bypass a sanity check and cause an exploitable heap out-of-bounds write. The flaw was introduced in commit f6fb8f10 on August 19, 2011, a 2014 fix attempt was insufficient, and it was fixed in commit 2b6867c2 on March 29, 2017, affecting distributions including Ubuntu and Android.
What's compelling: Triggering the bug requires CAP_NET_RAW, but that can be obtained from a user namespace where CONFIG_USER_NS is enabled and accessible to unprivileged users, so a local privilege escalation path exists on kernels with AF_PACKET enabled; Ubuntu kernels were already updated while Android's update was scheduled for July.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2017-7308
Related: CVE-2020-14386: Privilege Escalation Vulnerability in the Linux kernel Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026